From f129fd454972605ad9a97125a1c96a5b068615e7 Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Mon, 26 Apr 2021 11:04:42 +0100
Subject: [PATCH] .

---
 rapids/forms.py | 8 ++++----
 rapids/views.py | 6 ++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/rapids/forms.py b/rapids/forms.py
index aa43334d..cd7b02cd 100755
--- a/rapids/forms.py
+++ b/rapids/forms.py
@@ -83,7 +83,8 @@ class RapidForm(ModelForm):
         # Adding this javascript is crucial
         js = ["jsi18n.js", "tesseract.min.js"]
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, user, *args, **kwargs):
+        self.user = kwargs.pop('user')  # To get request.user. Do not use kwargs.pop('user', None) due to potential security hole
         if kwargs.get("instance"):
             # We get the 'initial' keyword argument or initialize it
             # as a dict if it didn't exist.
@@ -118,11 +119,10 @@ class RapidForm(ModelForm):
             choices=Rapid.LATERALITY_CHOICES, required=False, widget=RadioSelect()
         )
 
-        user = self.request.user
-        if user.groups.filter(name="rapid_checker").exists():
+        if self.user.groups.filter(name="rapid_checker").exists():
             return Exam.objects.all()
         
-        exam_queryset =  Exam.objects.filter(author__id=user.id)
+        exam_queryset =  Exam.objects.filter(author__id=self.user.id)
 
         self.fields["exams"] = ModelMultipleChoiceField(
             required=False,
diff --git a/rapids/views.py b/rapids/views.py
index 2a1cf070..9fb9d9da 100755
--- a/rapids/views.py
+++ b/rapids/views.py
@@ -270,6 +270,12 @@ class RapidCreateBase(LoginRequiredMixin, CreateView):
     model = Rapid
     form_class = RapidForm
 
+    # Sending user object to the form, to verify which fields to display/remove (depending on group)
+    def get_form_kwargs(self):
+        kwargs = super(RapidCreateBase, self).get_form_kwargs()
+        kwargs.update({'user': self.request.user})
+        return kwargs
+
     def get_context_data(self, **kwargs):
         context = super(RapidCreateBase, self).get_context_data(**kwargs)
         if self.request.POST: